File size: 4,906 Bytes
0dff816 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 |
<?php
// profile_handler.php
session_start();
header('Content-Type: application/json');
// Database configuration
$host = '127.0.0.1';
$dbname = 'jmdb';
$username = 'root';
$password = 'YourStrongPassword123';
try {
$pdo = new PDO("mysql:host=$host;dbname=$dbname", $username, $password);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
echo json_encode(['success' => false, 'message' => 'Database connection failed']);
exit;
}
if (!isset($_SESSION['user_id'])) {
echo json_encode(['success' => false, 'message' => 'Not authenticated']);
exit;
}
$user_id = $_SESSION['user_id'];
$action = $_POST['action'] ?? '';
switch($action) {
case 'get_profile':
getProfile($pdo, $user_id);
break;
case 'update_profile':
updateProfile($pdo, $user_id);
break;
case 'change_password':
changePassword($pdo, $user_id);
break;
case 'get_activity':
getActivity($pdo, $user_id);
break;
default:
echo json_encode(['success' => false, 'message' => 'Invalid action']);
}
function getProfile($pdo, $user_id) {
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$user_id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user) {
unset($user['password_hash']);
echo json_encode(['success' => true, 'profile' => $user]);
} else {
echo json_encode(['success' => false, 'message' => 'User not found']);
}
}
function updateProfile($pdo, $user_id) {
$allowed_fields = ['first_name', 'last_name', 'email', 'phone_number', 'country_code'];
$updates = [];
$params = [];
foreach ($allowed_fields as $field) {
if (isset($_POST[$field]) && $_POST[$field] !== '') {
$updates[] = "$field = ?";
$params[] = $_POST[$field];
}
}
if (empty($updates)) {
echo json_encode(['success' => false, 'message' => 'No valid fields to update']);
return;
}
$params[] = $user_id;
$sql = "UPDATE users SET " . implode(', ', $updates) . ", last_updated = CURRENT_TIMESTAMP WHERE id = ?";
try {
$stmt = $pdo->prepare($sql);
$stmt->execute($params);
// Log the activity
logActivity($pdo, $user_id, 'profile_update', 'Updated profile information');
echo json_encode(['success' => true, 'message' => 'Profile updated successfully']);
} catch (PDOException $e) {
echo json_encode(['success' => false, 'message' => 'Update failed: ' . $e->getMessage()]);
}
}
function changePassword($pdo, $user_id) {
if (!isset($_POST['current_password']) || !isset($_POST['new_password']) || !isset($_POST['confirm_password'])) {
echo json_encode(['success' => false, 'message' => 'All password fields are required']);
return;
}
$current_password = $_POST['current_password'];
$new_password = $_POST['new_password'];
$confirm_password = $_POST['confirm_password'];
if ($new_password !== $confirm_password) {
echo json_encode(['success' => false, 'message' => 'New passwords do not match']);
return;
}
if (strlen($new_password) < 6) {
echo json_encode(['success' => false, 'message' => 'Password must be at least 6 characters long']);
return;
}
// Get current password hash
$stmt = $pdo->prepare("SELECT password_hash FROM users WHERE id = ?");
$stmt->execute([$user_id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$user || !password_verify($current_password, $user['password_hash'])) {
echo json_encode(['success' => false, 'message' => 'Current password is incorrect']);
return;
}
// Update password
$new_password_hash = password_hash($new_password, PASSWORD_DEFAULT);
$stmt = $pdo->prepare("UPDATE users SET password_hash = ?, last_updated = CURRENT_TIMESTAMP WHERE id = ?");
$stmt->execute([$new_password_hash, $user_id]);
// Log the activity
logActivity($pdo, $user_id, 'password_change', 'Changed account password');
echo json_encode(['success' => true, 'message' => 'Password updated successfully']);
}
function getActivity($pdo, $user_id) {
$stmt = $pdo->prepare("SELECT activity_type, description, timestamp FROM user_activity WHERE user_id = ? ORDER BY timestamp DESC LIMIT 50");
$stmt->execute([$user_id]);
$activities = $stmt->fetchAll(PDO::FETCH_ASSOC);
echo json_encode(['success' => true, 'activities' => $activities]);
}
function logActivity($pdo, $user_id, $type, $description) {
$ip_address = $_SERVER['REMOTE_ADDR'];
$stmt = $pdo->prepare("INSERT INTO user_activity (user_id, activity_type, description, ip_address) VALUES (?, ?, ?, ?)");
$stmt->execute([$user_id, $type, $description, $ip_address]);
}
?> |